Privacy Policy

Information pursuant to Art. 13 and 14 of the General Data Protection Regulation (GDPR).

2.1 Controller

The controller within the meaning of the GDPR is:

Andreas Mayer
Speakspeak.net
c/o MDC#1028
Welserstraße 3
87463 Dietmannsried
Germany

Email for privacy enquiries: contact@speakspeak.net

A data protection officer has not been appointed.

2.2 What is SpeakSpeak?

SpeakSpeak is a communication platform for text, voice and video communication (communities/“servers”, channels, direct messages, forums, voice and video conferences, screen sharing). The service is operated and hosted exclusively by us as the provider; operation by third parties (“self-hosting”) does not take place. The service is currently in a closed beta phase; registration is only possible with a serial number issued by us.

2.3 Categories of data processed

a) Account data

• email address
• username / handle
• date of birth (used to verify the minimum age, see section 2.13)
• password, stored exclusively as a cryptographic hash (Argon2); we do not store the password in plain text
• optional: profile picture (avatar)
• time zone (for displaying times)
• account tier

b) Content data

• text messages in channels, direct messages (including group direct messages), forum posts and comments
• voice messages (recorded audio files)
• uploaded files and attachments (images, videos, audio, other files)
• reactions (emoji reactions to messages)
• custom emoji and soundboard sounds uploaded by users
• edit histories of messages and posts (versioning, see section 2.8)

c) Technical data

• IP addresses
• server and access logs (e.g. endpoints accessed, timestamps, status codes, error events)
• session and authentication tokens (JWT, access and refresh tokens)
• presence/online status (online, away, offline, etc.)
• device/connection information, insofar as technically required to establish the connection

d) Real-time media (voice / video / screen sharing)

• Audio, video and screen-sharing streams in voice channels and calls. Transmission takes place in real time via media infrastructure operated by us (LiveKit SFU); the media traffic is transmitted directly between your device and our media server. We do not record voice/video conferences.

e) Moderation and safety data

• reports submitted by users about content or other users (content of the report, reported content/context, reporting and reported person)
• results of automatic checks of uploaded files (see section 2.5)
• moderation and administration records (audit log)

2.4 Purposes and legal bases of processing

Where processing is based on Art. 6(1)(f) GDPR, you may object to it under the conditions of Art. 21 GDPR (see section 2.10).

2.5 Automatic checking of uploaded files

Uploaded files are processed automatically before being made available:

• Virus scanning with a virus scanner operated by us (ClamAV, operated in the EU). Files detected as malicious are not made available.
• Removal of metadata: embedded metadata (EXIF, e.g. GPS coordinates, camera data) is removed from images before they are shown to other users. This protects your privacy.
• For images, preview images (thumbnails) are additionally generated; audio/video files may be technically converted (transcoding).

Planned, currently not active: an automated comparison of uploaded files against hash values of known unlawful content, in particular child sexual abuse material (CSAM), combined with blocking of detected content, the legally required reporting to the competent bodies and human review. This privacy policy will be updated before this feature is activated.

2.6 Recipients and processors

We use the following service providers and infrastructure to deliver the service:

Processing in the EU

The core infrastructure (application, databases, media servers) runs mainly on a server rented from netcup GmbH and partly on the provider’s own, self-operated hardware — in both cases in the EU and fully administered by ourselves: we run the operating system, databases and applications under our own responsibility; no hyperscaler and no US corporation is involved in this. With the external service providers listed above, insofar as they process personal data on our behalf, we conclude data processing agreements pursuant to Art. 28 GDPR.

No content delivery network, proxy or tunnel; direct, end-to-end TLS-secured connection

All web, API and real-time voice/video traffic of the service runs directly between your device and our servers in the EU. There is no content delivery network, no reverse proxy and no tunnel service in between. TLS encryption is terminated exclusively on our servers; at no point are the transmitted contents processed in plain text by a third party.

The authoritative DNS management of the domain speakspeak.net is handled by Cloudflare, Inc. (USA). This concerns solely the technical resolution of the domain name to the IP address of our server (nameserver function) and does not include the content or payload of your communication. Your traffic is not routed through Cloudflare infrastructure.

Disclosure to other third parties

Personal data is disclosed to other third parties only where we are legally obliged to do so (e.g. requests for information from authorised authorities, future statutory reporting duties regarding abuse material) or where you have given consent. We do not sell data and do not use it for third-party advertising.

Visibility within the service

SpeakSpeak is a communication platform: content you publish in communities/channels or forums, as well as your username, avatar and online status, is visible to the other members of the respective community or to the recipients of your direct messages. Community administrators and moderators can view and manage content in their community as part of moderation.

2.7 Cookies and local storage

The service is tracker-free: we use no third-party analytics, advertising or tracking services and create no usage profiles for advertising purposes.

The marketing website at speakspeak.net itself sets no cookies or local storage whatsoever. The technically necessary storage mechanisms described below concern only the application (web app at web.speakspeak.net).

Only technically necessary storage mechanisms are used:

• session/authentication tokens (JWT), stored in the client (browser storage or app storage) to keep you signed in;
• local settings (e.g. language, time zone, notification settings) and a local message cache on your device for faster display.

Under § 25(2) no. 2 of the German TDDDG, no consent is required for storage that is strictly technically necessary. A cookie banner is therefore not provided.

2.8 Retention periods and deletion (“soft delete”)

• Account data is stored for the duration of the user relationship. After account deletion it is deleted or anonymised, unless statutory retention duties or the moderation purposes described below stand in the way. Deletion or anonymisation takes place at the latest 30 days after receipt of the deletion request.
• Content (messages, posts, files): When you delete a piece of content, it becomes invisible to other users but is initially not finally removed (“soft delete”). Likewise, when content is edited, the previous versions are retained (versioning). This serves moderation purposes (e.g. traceability of reported content, preservation of evidence in cases of abuse) and compliance with statutory retention and cooperation duties. Such content is finally deleted after a retention period of 90 days, unless a specific reason for retention exists (e.g. an ongoing moderation case, an order by an authority, a “legal hold”). File contents (stored file bytes) may be finally removed after the defined period has expired.
• Server/access logs are deleted after 30 days, unless they are needed for longer to investigate specific security incidents.
• Session tokens have short validity periods (access token: 15 minutes; refresh token: 30 days) and become invalid on logout or expiry.
• User reports and moderation cases are retained for 12 months.
• Backup copies: to protect against data loss we create encrypted backup copies of the database and of the file storage every day. Backups are overwritten after 30 days at the latest. An additional versioned copy on the provider’s own hardware may retain individual backup states temporarily for longer. No deleted account is restored from backups; they serve solely to restore the service after data loss.

2.9 Data security

We take technical and organisational measures pursuant to Art. 32 GDPR, including: transport encryption (TLS) for all connections; storage of passwords exclusively as an Argon2 hash; signed, short-lived authentication tokens; access controls and a permission system; separate systems for identity and community data; limiting of login attempts; logging of security-relevant events. Uploaded files are not publicly retrievable; access takes place only via access-checked, time-limited retrieval links or via the server.

2.10 Your rights as a data subject

You have the following rights against us with regard to the personal data concerning you:

• access (Art. 15 GDPR), covering the data processed, purposes, recipients, retention period and more;
• rectification (Art. 16 GDPR) of inaccurate or incomplete data;
• erasure (Art. 17 GDPR), unless an exception applies (e.g. a statutory retention duty, defence of legal claims);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR), receipt of the data you provided in a structured, commonly used, machine-readable format;
• objection (Art. 21 GDPR) to processing based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation;
• withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future.

To exercise your rights, an informal message is sufficient: contact@speakspeak.net

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP)
Hintere Bleiche 34
55116 Mainz
Germany
https://www.datenschutz.rlp.de/

2.11 No automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place. Automatic file checks (section 2.5) do not lead to decisions with legal effect without the possibility of human review.

2.12 Obligation to provide data

Providing an email address, a username, a password and a date of birth is required for registration and use of the service; without this information, no account can be created. All further information (e.g. avatar) is voluntary.

2.13 Minors

The service is not directed at persons under 16 years of age. The date of birth is requested during registration; we use it exclusively to verify the minimum age (Art. 8 GDPR). If we learn that an account is held by a person under 16, we suspend and close the account; section 2.8 applies to the deletion of the data.

2.14 Changes to this privacy policy

We update this privacy policy when the processing or the legal situation changes (e.g. the introduction of payment features, activation of the CSAM hash comparison). The version published on the website at the time applies.

Last updated: 17 August 2026 (German original)